PT-2025-36338 · Robocode · Robocode

Febou92 · Published 2025-09-05 · Updated 2025-09-06 · CVE-2025-58370

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roo Code versions prior to 3.26.0

Description Roo Code is an AI-powered autonomous coding agent. A weakness exists in the command parsing logic due to incorrect handling of Bash parameter expansion and indirect reference. If the agent was configured to auto-approve command execution, an attacker influencing prompts could execute arbitrary commands alongside intended ones.

Recommendations Update to Roo Code version 3.26.0 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-58370

GHSA-2RM5-CVCM-7592

Affected Products

Robocode

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58370.json · Exploit
• https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-2rm5-cvcm-7592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58370 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58370 · Vendor Advisory
• https://twitter.com/cypmsecnews/status/1964119197237055682 · Twitter Post
• https://twitter.com/CVEnew/status/1964195411763351751 · Twitter Post
• https://t.me/cveNotify/134521 · Telegram Post
• https://t.me/canyoupwnme/6916 · Telegram Post
• https://t.me/CVEtracker/31826 · Telegram Post